troxy-cli 1.11.1 → 1.13.0

package/bin/troxy.js

@@ -116,10 +116,28 @@ switch (command) {
     const existing  = loadConfig() || {};
     const oldKey    = existing.apiKey;
     const oldPrefix = oldKey ? oldKey.substring(0, 11) : null;
-    const name = flags.name || null; // keep existing name if not specified
+    // Find the key being replaced BEFORE creating its successor: we need both
+    // its agent and its name.
+    const { tokens: existingTokens = [] } = await api.listTokens(jwt);
+    const currentToken = oldPrefix ? existingTokens.find(t => t.prefix === oldPrefix) : null;
+
+    // Rotation must keep the agent. Troxy issues an agent id when a key is
+    // created, and a key with no agent_id gets a brand NEW agent, which is
+    // right for `troxy init` and exactly wrong here: rotating would orphan
+    // every decision, policy and recommendation the agent had built up. That
+    // is the one case this whole identity model exists to serve.
+    const agentId = currentToken && currentToken.agent_id ? currentToken.agent_id : null;
+
+    // Keep the name too. Defaulting to 'Rotated key' renamed the agent on
+    // every rotation, so even before agent ids existed you lost your history
+    // and ended up with an agent literally called "Rotated key".
+    const name = flags.name || (currentToken && currentToken.name) || null;
 
     process.stdout.write('\n  Creating new key... ');
-    const result    = await api.createToken(jwt, { name: name || 'Rotated key' });
+    const result    = await api.createToken(jwt, {
+      name,
+      ...(agentId ? { agent_id: agentId } : {}),
+    });
     const newKey    = result.key;
     const newPrefix = result.prefix;
     console.log('✓');
@@ -136,9 +154,7 @@ switch (command) {
 
     if (oldPrefix) {
       process.stdout.write(`\n  Revoking old key ${oldPrefix}... `);
-      const { tokens = [] } = await api.listTokens(jwt);
-      const old = tokens.find(t => t.prefix === oldPrefix);
-      if (old) { await api.revokeToken(jwt, old.id); console.log('✓'); }
+      if (currentToken) { await api.revokeToken(jwt, currentToken.id); console.log('✓'); }
       else console.log('(already revoked)');
     }
 
@@ -146,6 +162,7 @@ switch (command) {
   Key rotated:
     Old:  ${oldPrefix ? oldPrefix + '... (revoked)' : '(none)'}
     New:  ${newPrefix}...
+    Agent: ${agentId ? `${name || 'unchanged'} (history and policies kept)` : 'new agent (no previous key found to carry over)'}
 
   New key (shown once, save it now):
     ${newKey}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "troxy-cli",
-  "version": "1.11.1",
+  "version": "1.13.0",
   "description": "Control layer for AI agents: check payments, emails, logins and destructive actions against your policies",
   "homepage": "https://troxy.io",
   "bugs": {

package/src/api.js

@@ -75,6 +75,7 @@ export const api = {
   evaluateLogin: (body, apiKey) => request('POST', '/evaluate/login', { apiKey, body }),
   evaluateAction: (body, apiKey) => request('POST', '/evaluate/action', { apiKey, body }),
   selfRevoke: (apiKey) => request('POST', '/mcp/self-revoke', { apiKey }),
+  revokeAllOthers: (apiKey) => request('POST', '/mcp/revoke-all-others', { apiKey }),
   confirmPayment: (auditId, body, apiKey) => request('POST', `/payments/${auditId}/confirm`, { apiKey, body }),
   waitApprovalStatus: (token) => request('GET', `/approvals/${encodeURIComponent(token)}/wait`),
 

package/src/tests/rotate-key.test.js

@@ -0,0 +1,80 @@
+/**
+ * `troxy rotate-key` must keep the agent.
+ *
+ * Troxy issues an agent id when a key is created, and a request with no
+ * agent_id deliberately gets a brand NEW agent. That is right for `troxy init`
+ * and exactly wrong for rotation: it orphans every decision, policy and
+ * recommendation the agent had accumulated, which is the one case the identity
+ * model exists to serve.
+ *
+ * It also has to keep the name. Defaulting to 'Rotated key' renamed the agent
+ * on every rotation, so even before agent ids existed you lost your history and
+ * ended up with an agent called "Rotated key".
+ *
+ * These assert on the request body the command builds, because that body is
+ * the entire contract with the server.
+ */
+import { test } from 'node:test';
+import assert from 'node:assert';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const SRC = readFileSync(join(__dirname, '../../bin/troxy.js'), 'utf8');
+
+// The rotate-key case, isolated from the rest of the dispatcher.
+const ROTATE = SRC.slice(
+  SRC.indexOf("case 'rotate-key'"),
+  SRC.indexOf("case 'mcp'", SRC.indexOf("case 'rotate-key'")),
+);
+
+// Comments stripped, so a test that bans a string does not trip over the
+// comment explaining why the string is banned.
+const ROTATE_CODE = ROTATE
+  .replace(/\/\*[\s\S]*?\*\//g, '')
+  .replace(/^\s*\/\/.*$/gm, '');
+
+test('rotate-key sends the existing agent_id so the agent survives', () => {
+  assert.ok(
+    /agent_id:\s*agentId/.test(ROTATE),
+    'rotate-key must pass agent_id; without it the server mints a new agent and the old history is orphaned',
+  );
+  assert.ok(
+    /currentToken\s*&&\s*currentToken\.agent_id/.test(ROTATE),
+    'agent_id must come from the key being replaced, looked up by its prefix',
+  );
+});
+
+test('rotate-key no longer renames the agent to "Rotated key"', () => {
+  assert.ok(
+    !/['"]Rotated key['"]/.test(ROTATE_CODE),
+    'defaulting the name to "Rotated key" renames the agent on every rotation',
+  );
+  assert.ok(
+    /flags\.name\s*\|\|\s*\(currentToken && currentToken\.name\)/.test(ROTATE),
+    'rotation must keep the current name unless --name overrides it',
+  );
+});
+
+test('rotate-key looks the token up once, before creating its replacement', () => {
+  const listCalls = (ROTATE.match(/api\.listTokens\(/g) || []).length;
+  assert.strictEqual(
+    listCalls, 1,
+    `expected exactly one listTokens call, found ${listCalls}: the lookup has to happen before createToken so the agent id is known, and repeating it is a second round-trip for data already held`,
+  );
+  assert.ok(
+    ROTATE.indexOf('api.listTokens(') < ROTATE.indexOf('api.createToken('),
+    'the token must be resolved before the new key is created',
+  );
+});
+
+test('rotate-key still revokes the old key after re-pointing consumers', () => {
+  const reprovision = ROTATE.indexOf('reprovisionKeyConsumers(');
+  const revoke = ROTATE.indexOf('api.revokeToken(');
+  assert.ok(reprovision > -1 && revoke > -1, 'both steps must still be present');
+  assert.ok(
+    reprovision < revoke,
+    'consumers are re-pointed before the old key is revoked, otherwise every consumer keeps presenting a revoked key and control goes down',
+  );
+});

package/src/uninstall.js

@@ -87,12 +87,15 @@ function removeMcpEntries() {
 export async function runUninstall() {
   console.log('\n  Troxy: Uninstall\n');
 
-  const answer = await prompt('  This will remove Troxy from this machine. Continue? (y/N): ');
+  const answer = await prompt('  This will remove Troxy from this machine and revoke ALL your agent keys. Continue? (y/N): ');
   if (answer.toLowerCase() !== 'y') {
     console.log('\n  Cancelled.\n');
     process.exit(0);
   }
 
+  const cfg = loadConfig();
+  const apiKey = cfg?.apiKey;
+
   // 1. Stop and remove background service
   process.stdout.write('  Stopping background service...  ');
   const removed = removeService();
@@ -108,24 +111,45 @@ export async function runUninstall() {
     console.log('none found');
   }
 
-  // 3. Revoke the API key. /mcp/self-revoke only lets a key revoke the exact
-  // token it authenticates as — it can't touch or list any other token — so
-  // this doesn't need a login/JWT, the key on disk is enough.
-  const cfg = loadConfig();
-  if (cfg?.apiKey) {
-    const prefix = cfg.apiKey.slice(0, 12) + '...';
-    process.stdout.write(`  Revoking API key ${prefix}...  `);
+  // 3. Revoke all OTHER agent keys (cloud agents, other machines) using the
+  // local API key for auth — no troxy login needed. The key proves identity
+  // to the server, and /mcp/revoke-all-others kills every other active token
+  // for the same user. We do this BEFORE self-revoke so the key is still valid
+  // to make the call.
+  if (apiKey) {
+    process.stdout.write('  Revoking other agents...         ');
+    try {
+      const result = await api.revokeAllOthers(apiKey);
+      if (result.count > 0) {
+        console.log(`✓  (${result.count} agent${result.count > 1 ? 's' : ''})`);
+        for (const a of result.revoked) {
+          const conn = a.connection_type || 'local';
+          console.log(`    • ${a.name}  (${conn})`);
+        }
+      } else {
+        console.log('✓  (none found)');
+      }
+    } catch (err) {
+      console.log('✗');
+      console.log(`     Couldn't revoke other agents (${err.message}).`);
+      console.log('     Go to dash.troxy.io → API Keys to revoke them manually.\n');
+    }
+
+    // 4. Revoke THIS machine's API key (self-revoke). Done after revoke-all-others
+    // because self-revoke kills the key we're using to authenticate.
+    const prefix = apiKey.slice(0, 12) + '...';
+    process.stdout.write(`  Revoking local API key ${prefix}...  `);
     try {
-      await api.selfRevoke(cfg.apiKey);
+      await api.selfRevoke(apiKey);
       console.log('✓');
     } catch (err) {
       console.log('✗');
       console.log(`     Couldn't revoke automatically (${err.message}).`);
-      console.log('     Go to dash.troxy.io → Settings → API Keys to revoke it.\n');
+      console.log('     Go to dash.troxy.io → API Keys to revoke it.\n');
     }
   }
 
-  // 4. Delete ~/.troxy config
+  // 5. Delete ~/.troxy config
   process.stdout.write('  Removing config (~/.troxy)...  ');
   const configDir = path.join(os.homedir(), '.troxy');
   if (fs.existsSync(configDir)) {
@@ -135,7 +159,7 @@ export async function runUninstall() {
     console.log('not found');
   }
 
-  // 5. Remove npm package
+  // 6. Remove npm package
   process.stdout.write('  Uninstalling troxy CLI...      ');
   try {
     execSync('npm uninstall -g troxy-cli 2>/dev/null || npm uninstall -g troxy 2>/dev/null', { stdio: 'pipe' });
@@ -144,5 +168,5 @@ export async function runUninstall() {
     console.log('skipped (run manually: sudo npm uninstall -g troxy-cli)');
   }
 
-  console.log('\n  Troxy removed. Your payments are no longer protected by Troxy.\n');
+  console.log('\n  Troxy removed. All agent keys revoked. Your AI agents are no longer protected by Troxy.\n');
 }